Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 00:36
Static task
static1
Behavioral task
behavioral1
Sample
577e69319a6748819dae32946f3f11edab2782854018999e2e5f3519049a0fe0.exe
Resource
win10v2004-20241007-en
General
-
Target
577e69319a6748819dae32946f3f11edab2782854018999e2e5f3519049a0fe0.exe
-
Size
690KB
-
MD5
1d67d71aaf72f52ef65d2907636495ce
-
SHA1
54bb8cdc0dfd8dbbc5ed05296b0d63953828ba37
-
SHA256
577e69319a6748819dae32946f3f11edab2782854018999e2e5f3519049a0fe0
-
SHA512
82952628a9fd8543364977d44c7030c9b8fad8011904d15e5610a182bf3acfcf1de43d5878e5029812a45db77b1acb8ab28e35675e7de8ea865ff736d950bd1d
-
SSDEEP
12288:Ky907rzoq0kqdKshDV3R8KbetKy27BV/ljCiPGzqFYBqh:KymzCVd1DV3w92F2iubqh
Malware Config
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
Processes:
resource yara_rule behavioral1/memory/2732-19-0x0000000002260000-0x000000000227A000-memory.dmp healer behavioral1/memory/2732-21-0x00000000023C0000-0x00000000023D8000-memory.dmp healer behavioral1/memory/2732-27-0x00000000023C0000-0x00000000023D3000-memory.dmp healer behavioral1/memory/2732-49-0x00000000023C0000-0x00000000023D3000-memory.dmp healer behavioral1/memory/2732-47-0x00000000023C0000-0x00000000023D3000-memory.dmp healer behavioral1/memory/2732-45-0x00000000023C0000-0x00000000023D3000-memory.dmp healer behavioral1/memory/2732-43-0x00000000023C0000-0x00000000023D3000-memory.dmp healer behavioral1/memory/2732-41-0x00000000023C0000-0x00000000023D3000-memory.dmp healer behavioral1/memory/2732-39-0x00000000023C0000-0x00000000023D3000-memory.dmp healer behavioral1/memory/2732-37-0x00000000023C0000-0x00000000023D3000-memory.dmp healer behavioral1/memory/2732-35-0x00000000023C0000-0x00000000023D3000-memory.dmp healer behavioral1/memory/2732-33-0x00000000023C0000-0x00000000023D3000-memory.dmp healer behavioral1/memory/2732-31-0x00000000023C0000-0x00000000023D3000-memory.dmp healer behavioral1/memory/2732-29-0x00000000023C0000-0x00000000023D3000-memory.dmp healer behavioral1/memory/2732-25-0x00000000023C0000-0x00000000023D3000-memory.dmp healer behavioral1/memory/2732-23-0x00000000023C0000-0x00000000023D3000-memory.dmp healer behavioral1/memory/2732-22-0x00000000023C0000-0x00000000023D3000-memory.dmp healer -
Healer family
-
Processes:
44171669.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 44171669.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 44171669.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 44171669.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 44171669.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 44171669.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 44171669.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2508-60-0x0000000002640000-0x000000000267C000-memory.dmp family_redline behavioral1/memory/2508-61-0x00000000026E0000-0x000000000271A000-memory.dmp family_redline behavioral1/memory/2508-69-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-83-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-95-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-93-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-91-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-89-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-87-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-81-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-79-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-77-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-73-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-71-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-85-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-75-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-67-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-65-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-63-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline behavioral1/memory/2508-62-0x00000000026E0000-0x0000000002715000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
Processes:
un527031.exe44171669.exerk704667.exepid Process 3688 un527031.exe 2732 44171669.exe 2508 rk704667.exe -
Processes:
44171669.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 44171669.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 44171669.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
577e69319a6748819dae32946f3f11edab2782854018999e2e5f3519049a0fe0.exeun527031.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 577e69319a6748819dae32946f3f11edab2782854018999e2e5f3519049a0fe0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un527031.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 2800 2732 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
44171669.exerk704667.exe577e69319a6748819dae32946f3f11edab2782854018999e2e5f3519049a0fe0.exeun527031.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44171669.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rk704667.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 577e69319a6748819dae32946f3f11edab2782854018999e2e5f3519049a0fe0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un527031.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
44171669.exepid Process 2732 44171669.exe 2732 44171669.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
44171669.exerk704667.exedescription pid Process Token: SeDebugPrivilege 2732 44171669.exe Token: SeDebugPrivilege 2508 rk704667.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
577e69319a6748819dae32946f3f11edab2782854018999e2e5f3519049a0fe0.exeun527031.exedescription pid Process procid_target PID 4972 wrote to memory of 3688 4972 577e69319a6748819dae32946f3f11edab2782854018999e2e5f3519049a0fe0.exe 85 PID 4972 wrote to memory of 3688 4972 577e69319a6748819dae32946f3f11edab2782854018999e2e5f3519049a0fe0.exe 85 PID 4972 wrote to memory of 3688 4972 577e69319a6748819dae32946f3f11edab2782854018999e2e5f3519049a0fe0.exe 85 PID 3688 wrote to memory of 2732 3688 un527031.exe 86 PID 3688 wrote to memory of 2732 3688 un527031.exe 86 PID 3688 wrote to memory of 2732 3688 un527031.exe 86 PID 3688 wrote to memory of 2508 3688 un527031.exe 95 PID 3688 wrote to memory of 2508 3688 un527031.exe 95 PID 3688 wrote to memory of 2508 3688 un527031.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\577e69319a6748819dae32946f3f11edab2782854018999e2e5f3519049a0fe0.exe"C:\Users\Admin\AppData\Local\Temp\577e69319a6748819dae32946f3f11edab2782854018999e2e5f3519049a0fe0.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un527031.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un527031.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\44171669.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\44171669.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 10844⤵
- Program crash
PID:2800
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk704667.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk704667.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2732 -ip 27321⤵PID:3668
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536KB
MD5fbe14cf2deeed0180060be62c143a045
SHA14582ccd07371f56f93586690ce6396dd7d93fd18
SHA2561ac97cff016646db570027a037e833822df40a6ec488e75443ef46d80181e881
SHA51228b0ed0dca107a4a5e1c20cad9cbc1ec0c9aa39e875842d77b350553a52a9d78bce024a1833f400506f40fb9758036a288e308eeb32a2c865a8912cf2bfdccc5
-
Filesize
259KB
MD51ce131982f34352415785e8d244e3d00
SHA1370535c121259d65d1df598f7d75be6eddaee64f
SHA256a8c6e85b838dd8039c99ae882001393eb55d5c3b9e66aff611dafb5d14a2f1aa
SHA5122570f82f81dbe82600d1b1bb977d24ed9d93b89a54758a4b1621c39d2f7264d5e2f6323f8442b87200c34c31070a7a2569bad3e2a44ba129496e3d7d359422e9
-
Filesize
341KB
MD578fc9cbf3c447d8b02d65af78cd03a5b
SHA114390eb8dbbe1ef295bc5ca39526ed920df5ec7e
SHA2562af2417f22258154eea6239c93fd3f1433aa1aa3107c9c18773dcc08e75ace44
SHA512fc7cb43ccffc7d94309a629b0c97aef3c8f1b419fd71bff36ac53550a9ace202db5a8e0185b3093824538ed43555162d48dbe3833f45ae283a0ab596c9ff3713